Defense Methods Against Adversarial Examples for Recurrent Neural Networks

Abstract

Adversarial examples are known to mislead deep learning models to incorrectly classify them, even in domains where such models achieve state-of-the-art performance. Until recently, research on both attack and defense methods focused on image recognition, primarily using convolutional neural networks (CNNs). In recent years, adversarial example generation methods for recurrent neural networks (RNNs) have been published, demonstrating that RNN classifiers are also vulnerable to such attacks. In this paper, we present a novel defense method, termed sequence squeezing, to make RNN classifiers more robust against such attacks. Our method differs from previous defense methods which were designed only for non-sequence based models. We also implement four additional RNN defense methods inspired by recently published CNN defense methods. We evaluate our methods against state-of-the-art attacks in the cyber security domain where real adversaries (malware developers) exist, but our methods can be applied against other discrete sequence based adversarial attacks, e.g., in the NLP domain. Using our methods we were able to decrease the effectiveness of such attack from 99.9% to 15%.

arXiv commentSubmitted as a conference paper to Euro S&P 2020

References in corpus (18)

• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Certified Adversarial Robustness via Randomized Smoothing
• Generating Natural Adversarial Examples
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• GANS for Sequences of Discrete Elements with the Gumbel-softmax Distribution
• Maximum-Likelihood Augmented Discrete Generative Adversarial Networks
• Texygen: A Benchmarking Platform for Text Generation Models
• Adversarial Feature Matching for Text Generation
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Black-Box Attacks against RNN based Malware Detection Algorithms
• Generative Adversarial Trainer: Defense to Adversarial Perturbations with GAN
• Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks
• Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples
• Attack and Defense of Dynamic Analysis-Based, Adversarial Neural Malware Classification Models
• Robust Neural Malware Detection Models for Emulation Sequence Learning

Cited by in corpus (6)

• Binary Black-box Evasion Attacks Against Deep Learning-based Static Malware Detectors with Adversarial Byte-Level Language Model
• A Visual Analytics Framework for Adversarial Text Generation
• Crafting Adversarial Examples for Deep Learning Based Prognostics (Extended Version)
• Spatially Focused Attack against Spatiotemporal Graph Neural Networks
• Bio-Inspired Adversarial Attack Against Deep Neural Networks
• Thwarting finite difference adversarial attacks with output randomization